Yes, charities need cookie consent. Data protection and cookie rules make no exception for nonprofit status: under Article 5(3) of the ePrivacy Directive and the UK's PECR, analytics, advertising and donation-tracking cookies need consent before they are set. The one recent change is in the UK, where, since 5 February 2026, analytics used only to improve your own site and cookies that remember how a visitor wants the site to look can run without consent, as long as you explain them and offer a free way to object.
Charities are not exempt from cookie laws
A common misconception among nonprofit organisations is that privacy regulations only target commercial businesses. The General Data Protection Regulation makes no distinction based on profit status. Article 2 of the GDPR states that the regulation applies to any entity processing personal data, whether a multinational retailer or a local food bank.
The same principle holds for cookie-specific rules. Article 5(3) of the ePrivacy Directive requires prior consent before storing or accessing information on a visitor's device, with only two narrow exceptions: the communication exemption and the strictly necessary exemption. Neither exemption covers analytics, advertising, or donation tracking cookies.
In the UK, the Privacy and Electronic Communications Regulations 2003 (PECR) follow the same model, and the ICO applies them to all organisations, charities included. As of October 2026, PECR also carries the narrower UK exceptions described below, and the higher PECR fines that took effect on 5 February 2026, aligned with the UK GDPR maximum of £17.5 million or 4% of worldwide turnover.
The cookies charity websites typically set
Most nonprofit websites set more cookies than their operators realise. A typical charity site running Google Analytics 4, a donation platform, and social sharing buttons can set many cookies across several categories.
Here is a breakdown of common cookies found on charity websites:
| Cookie | Category | Purpose | Consent required? |
|---|---|---|---|
PHPSESSID | Strictly necessary | Maintains server session | No |
pll_language | Functional | Stores language preference | Often no, when it stores the visitor's own choice |
_ga | Analytics | Google Analytics visitor ID | Yes in the EU. In the UK, possibly not if the analytics meets the statistics exception |
_ga_* | Analytics | GA4 session tracking | Yes |
_fbp | Marketing | Meta Pixel tracking | Yes |
__stripe_mid | Functional / Analytics | Stripe fraud detection | Context-dependent |
NID | Marketing | Google advertising preferences | Yes |
Payment processors such as Stripe and PayPal set their own cookies for fraud prevention. Some of these qualify as strictly necessary when directly tied to a transaction. Others, particularly those used for behavioural analysis, do not.
Donation tracking needs consent
Charities rely on conversion tracking to measure donation campaign effectiveness. A Meta Pixel on a donation thank-you page, a Google Ads conversion tag, or a fundraising platform's built-in analytics all set cookies that require prior consent under GDPR and PECR.
This creates a tension. Without tracking, charities cannot attribute donations to specific campaigns, making it harder to allocate limited marketing budgets. With tracking, they need a consent mechanism that some donors may dismiss or reject.
The practical solution is twofold. First, use server-side tagging or the platform's server-side conversion API (such as Meta's Conversions API) to reduce reliance on client-side cookies. Second, implement a clear, honest cookie banner that explains why tracking matters for the charity's mission.
Three ways to keep analytics when visitors decline
Charities concerned about losing analytics data when visitors decline cookies have several paths forward.
Privacy-preserving analytics tools such as Plausible and Fathom operate without setting cookies at all. They provide aggregate traffic data, page views, and referral sources without collecting personal data. For many small charities, this level of insight is sufficient.
Google Analytics 4 works with Google Consent Mode, which uses statistical modelling to estimate conversions when users decline tracking. The modelled data fills some of the measurement gap, though accuracy varies depending on traffic volume and consent rates.
A third option is to rely on first-party data that donors voluntarily provide - email addresses, survey responses, and direct feedback. This zero-party data approach aligns well with the trust-based relationship charities cultivate with supporters.
The UK Data (Use and Access) Act changed two rules for charities in 2026
UK-based charities should pay close attention to the Data (Use and Access) Act, which changed two things for the sector on 5 February 2026. First, charities can now use the "soft opt-in" for email and text marketing to people who expressed an interest in, or supported, their charitable purposes. Previously, this exemption was limited to commercial organisations.
The soft opt-in covers email and text marketing only, not cookies. But the same Act also changed the cookie rules. It added new exceptions to PECR in Schedule A1, and two matter for most charity websites:
Statistics: cookies whose sole purpose is to collect statistics about how your site is used, to improve it, need no consent if the data is not shared except with someone helping you make those improvements, and visitors get clear information and a simple, free way to object
Appearance: cookies that adapt how the site looks or works to a visitor's preferences, such as a chosen language, need no consent on the same terms of information and a free objection
Advertising cookies such as _fbp and donation-tracking pixels still need consent. Whether a Google Analytics set-up meets the statistics exception depends on what is shared with Google, so check the ICO's guidance before relying on it. These exceptions are UK-only: for visitors in the EU, analytics still needs consent.
Charities also cannot use the soft opt-in to promote products or services, even if profits go back to the charity.
Enforcement against charities is rare, not impossible
Data protection authorities have not made charities a primary target for cookie enforcement, but they have granted no immunity either. Most cookie enforcement has focused on large commercial websites. The ICO's review of the UK's top 1,000 websites, which reported in December 2025 that 979 were compliant, showed how a regulator can move through a whole tier of high-traffic sites, and large charity sites sit in that tier.
Smaller charities face a different risk: reputational damage. A donor who sees their data mishandled is unlikely to contribute again. Transparent cookie consent practices build trust with the very audience charities depend on.
What a fair charity cookie banner looks like
A charity's cookie banner should follow the same principles as any other organisation's banner, with a few considerations specific to the sector.
The banner must offer a genuine choice. That means a clearly visible reject option alongside the accept button, with no dark patterns such as hidden decline links or colour manipulation. The EDPB and CNIL have made clear that button parity is expected.
Cookie categories should be labelled in plain language. Rather than "performance cookies", say "cookies that help us understand how visitors use this site". Category descriptions should explain purpose, not just use technical jargon.
For multilingual charity websites serving international communities, the banner should appear in the visitor's language. Kukie.io's banner ships in more than 70 languages, which helps charities with a global supporter base present consent information clearly.
Practical steps for a nonprofit website
Start with a cookie audit. Run an automated scan of your website to identify every cookie and tracking technology in use. Many charities discover cookies they did not know existed, often set by third-party plugins, embedded maps, or social sharing widgets.
Classify each cookie into the correct category: strictly necessary, functional, analytics, or marketing. Only strictly necessary cookies may fire without consent in the EU. In the UK, statistics and appearance cookies may also run without consent if you explain them and offer a free way to object.
Implement a consent management platform that blocks non-essential cookies until the visitor makes a choice. Kukie.io's script blocking and geo-detection features hold known trackers until consent and show each region the consent model you choose for it.
Document your cookie processing in a clear cookie policy that lists each cookie by name, purpose, provider, and duration. Link to this policy from your banner.
Questions charities ask about cookie consent
Do charities need cookie consent under GDPR?
Yes. GDPR applies to all organisations processing personal data of EU residents, regardless of profit status. The ePrivacy Directive also requires prior consent for non-essential cookies on any website, including charity sites.
Are donation page cookies strictly necessary?
Session cookies that maintain a donation transaction in progress (such as PHPSESSID) can qualify as strictly necessary. Tracking cookies used to measure donation campaign performance, such as _ga or _fbp, require consent.
Can a charity use Google Analytics without a cookie banner?
In the EU, no: Google Analytics cookies like _ga need consent. In the UK, analytics used only to improve your own site can run without consent since 5 February 2026 if you explain it and let visitors object, but check the ICO's guidance before relying on it for Google Analytics. Cookieless tools like Plausible or Fathom avoid the question.
Does the UK soft opt-in exemption apply to cookies?
No. The Data (Use and Access) Act 2025 extended the soft opt-in to charity email and text marketing, but this exemption does not cover website cookies or tracking technologies. The cookie rules changed separately: since 5 February 2026, some UK analytics and appearance cookies are exempt from consent if visitors can object.
What happens if a charity ignores cookie consent rules?
DPAs can issue fines, enforcement notices, or reprimands. Beyond financial penalties, non-compliance risks damaging donor trust, which for charities is often more costly than any fine.
How can a small charity afford cookie compliance?
Free and low-cost consent management tools exist. Running a free cookie scan identifies what your site sets, and a basic consent banner can be configured without developer resources. Kukie.io's Free plan covers up to 5 websites with unlimited pageviews.
Find out what your charity website sets before supporters do
If you are not sure which cookies your charity website sets, start with a free scan. Kukie.io lists the cookies it finds, suggests a category for each and holds non-essential trackers until visitors choose, so your supporters get a clear choice before tracking starts.
